terraform {
  required_version = ">= 1.5"
  required_providers {
    dokploy = {
      source  = "maxvojtkov/dokploy"
      version = ">= 0.1"
    }
  }
}

locals {
  # Exactly one source block is populated, chosen by var.service_source.type.
  is_docker = var.service_source.type == "docker"
  is_github = var.service_source.type == "github"
  is_git    = var.service_source.type == "git"
}

resource "dokploy_application" "this" {
  name           = var.name
  description    = var.description
  environment_id = var.environment_id
  server_id      = var.server_id

  source_type = var.service_source.type

  # Docker image source
  docker_image = local.is_docker ? var.service_source.image : null
  username     = local.is_docker ? var.service_source.registry_username : null
  password     = local.is_docker ? var.service_source.registry_password : null
  registry_url = local.is_docker ? var.service_source.registry_url : null

  # GitHub source
  github_id  = local.is_github ? var.service_source.github_id : null
  owner      = local.is_github ? var.service_source.owner : null
  repository = local.is_github ? var.service_source.repository : null
  branch     = local.is_github ? var.service_source.branch : null
  build_path = local.is_github ? var.service_source.build_path : null

  # Plain Git source
  custom_git_url        = local.is_git ? var.service_source.url : null
  custom_git_branch     = local.is_git ? var.service_source.branch : null
  custom_git_build_path = local.is_git ? var.service_source.build_path : null
  custom_git_ssh_key_id = local.is_git ? var.service_source.ssh_key_id : null

  build_type = var.build_type
  dockerfile = var.dockerfile

  env         = var.env
  build_args  = var.build_args
  auto_deploy = var.auto_deploy

  replicas           = var.replicas
  memory_reservation = var.resources.memory_reservation
  memory_limit       = var.resources.memory_limit
  cpu_reservation    = var.resources.cpu_reservation
  cpu_limit          = var.resources.cpu_limit
}

resource "dokploy_domain" "this" {
  for_each = { for domain in var.domains : domain.host => domain }

  application_id   = dokploy_application.this.id
  domain_type      = "application"
  host             = each.value.host
  path             = each.value.path
  port             = each.value.port
  https            = each.value.https
  certificate_type = each.value.https ? each.value.certificate_type : "none"
  strip_path       = each.value.strip_path
  internal_path    = each.value.internal_path
}

resource "dokploy_port" "this" {
  for_each = { for port in var.published_ports : "${port.protocol}-${port.published_port}" => port }

  application_id = dokploy_application.this.id
  published_port = each.value.published_port
  target_port    = each.value.target_port
  protocol       = each.value.protocol
  publish_mode   = each.value.publish_mode
}

resource "dokploy_mount" "this" {
  for_each = { for mount in var.mounts : mount.mount_path => mount }

  service_id   = dokploy_application.this.id
  service_type = "application"
  type         = each.value.type
  mount_path   = each.value.mount_path
  volume_name  = each.value.volume_name
  host_path    = each.value.host_path
  file_path    = each.value.file_path
  content      = each.value.content
}

# count rather than for_each: basic_auth is sensitive, and Terraform refuses to
# derive resource instance keys from sensitive values.
resource "dokploy_security" "this" {
  count = var.basic_auth == null ? 0 : 1

  application_id = dokploy_application.this.id
  username       = var.basic_auth.username
  password       = var.basic_auth.password
}

resource "dokploy_redirect" "this" {
  for_each = { for redirect in var.redirects : redirect.regex => redirect }

  application_id = dokploy_application.this.id
  regex          = each.value.regex
  replacement    = each.value.replacement
  permanent      = each.value.permanent
}